EUVD-2026-56651
GHSA-x9jv-vwc6-qrrc
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only UAF exploit requiring low privilege and high-complexity timing conditions; kernel-level impact yields full C/I/A compromise within unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation via use-after-free in the Windows Kernel allows a locally authenticated, low-privileged attacker to gain SYSTEM-level access on affected Windows 11 and Windows Server 2025 installations. The flaw (CWE-416) involves kernel memory mismanagement where freed memory can be accessed under specific high-complexity timing conditions, yielding full confidentiality, integrity, and availability compromise of the host. No public exploit code has been identified at time of analysis, but Microsoft has released patches for all affected versions.
Technical ContextAI
CWE-416 (Use After Free) occurs when the Windows Kernel accesses heap or pool memory after it has been freed, allowing an attacker to manipulate the memory region between the free and the subsequent access - a classic kernel UAF exploitation primitive. This class of vulnerability in kernel mode is particularly dangerous because successful exploitation operates with ring-0 privileges. The CVSS vector AV:L/AC:H reflects that the attack is local and requires high complexity, consistent with kernel UAF exploits that typically depend on precise heap-spray, race conditions, or reclamation timing. Affected CPE targets include Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025 (full and Server Core installations), all running builds below the patched thresholds identified in the EUVD advisory EUVD-2026-56651.
RemediationAI
Apply the Microsoft-released patches immediately via Windows Update or WSUS: update Windows 11 Version 24H2 to build 10.0.26100.9168 or later, Windows 11 Version 25H2 to build 10.0.26200.9168 or later, Windows 11 Version 26H1 to build 10.0.28000.2704 or later, and Windows Server 2025 (including Server Core) to build 10.0.26100.33296 or later. The authoritative Microsoft advisory is at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62749. If immediate patching is not feasible, compensating controls should focus on limiting local interactive and remote desktop access for untrusted or low-privileged accounts, restricting the attack surface by enforcing least-privilege policies, and monitoring for anomalous privilege escalation events (Event ID 4672 and kernel object access auditing). Note that these controls reduce exposure but do not eliminate the vulnerability - patching remains the only definitive remediation.
More in Windows 11 24h2
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Mark of the Web Security Feature Bypass Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is r
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today